January 2011

The Commerce Department is pushing a "National Strategy for Trusted Identities in Cyberspace" plan, wherein passwords would give way to a single login on phones and computers. These logins would rely on biometric card technology, or something similar. This sounds a lot like Apple's NFC plans. Here's why Apple's idea is better.

The online password, we know, is a broken system. Gawker's database hack alone demonstrates how weak a security system it is, along with countless pieces of research (although, of course, not everyone is as juicy a target as Gawker). And when you add in the hassle factor of remembering a string of passwords to tap in to every site as we increasingly live our lives online, the password system sure becomes a giant pain in the you know where. (Hence the rise of Facebook's universal login--although that still relies on a password.) Some system that replaces all of this mess would be most welcome.

Enter the National Strategy for Trusted Identities in Cyberspace (NSTIC), which has been around in draft form for a while but is now getting serious government backing. As BusinessWeek notes in its piece about the idea, it's a "new online security system that experts say will eliminate the password maze and perhaps boost e-commerce." The article even quotes John Clippinger, co-director of Harvard's Law Lab at the Berkman Center for Internet and Society and an "advocate" of the plan as saying it'll "be far more efficient and you'll control it a lot more." The trick behind the NSTIC is that there will be some form of universal login system that replaces the password every time you flick on a PC or power-up your smartphone. It would be unique to you, and it would establish your identity in a secure, encrypted way that could be shared with online services--meaning you'd never need to remember another online password. The idea is that some kind of physical token, like an RFID card, would be waved over a sensor, possibly combined with direct biometric markers like a fingerprint. It would make logins much easier, says the Dept. of Commerce, it could push online more services that are don't yet trust the Net (like medical records), and it could revolutionize online trading because it'd enable vendors to believe in the identity of their customers, while lessening the chances of fraud. One could even imagine an eventual reduction in the size of company help desks, as one of their biggest burdens is "dealing with lost passwords," according to Homeland Security spokesman Bruce McConnell.

The government has promised to get things off to a running start by pushing agencies to adopt NSTIC for taxes, veterans benefits, and so on. But all of this activity might be too late--and not good enough. Apple, along with a number of other companies, has long been exploring this kind of system, and Apple, seemingly above all others, has aggressively patented ideas in the field of NFC RFID tech. (That's Near Field Communication and Radio Frequency Identification, for those keeping score at home.) The ideas include logins at computers, ATMs, and so on--and they could revolutionize payment systems in stores in ways we can only barely imagine. If Apple does put NFC into its next-gen iPhone and iPod Touch (leveraging its global database of millions of iTunes subscriber credit cards), it could possibly encourage a paradigm shift in payment tech, in the same way it's transformed digital music and smartphones. An army of clone companies would follow.

Fair Information Practice Principles are a "useful tool" when analyzing online privacy, but should not be codified in new regulations or laws, a coalition of 13 ad, media and business organizations argue in comments submitted Jan 28 to the Department of Commerce.

Formally establishing a fair information principles-based framework for online privacy "would reduce industry's ability to respond to changes in consumer preferences and would hinder advancements in technology," the Interactive Advertising Bureau, American Association of Advertising Agencies, Association of National Advertisers, Newspaper Association of America and other groups say. The organizations' comments were submitted in response to a proposal by the Department of Commerce that industry groups and consumer advocates should jointly develop enforceable self-regulatory privacy policies based on Fair Information Practice Principles. The groups argue that Fair Information Practice Principles "serve as the foundation for many self-regulatory programs," but say that the principles should be "applied through self-regulation in a manner tailored to meet the particular context." What's more, the groups say, some of the principles aren't necessarily appropriate for companies engaged in online behavioral targeting, or tracking people as they surf the Web in order to serve them targeted ads.

US military and law enforcement officials say the government has made significant strides in figuring out who is responsible for complex cyber attacks, a fundamental but elusive first step to determine whether the U.S. should strike back, whom to strike, and how hard.

US authorities are using a mix of high-tech forensics and a greater emphasis on spying within the online world, although officials won't reveal exactly how they are ferreting out cyber criminals in the vast, often anonymous Internet universe. Officials familiar with the issue say the escalating cyber security threat has triggered a greater government-wide emphasis on collecting intelligence related to computer crimes. The officials spoke on condition of anonymity to discuss intelligence gathering. The broader approach includes spycraft methods from electronic surveillance and satellites to international cooperation and the everyday tactics and techniques that undercover agents use.

Telenor, one of the largest Internet providers in Norway, used to love net neutrality; back in 2009, it voluntarily signed on to a net neutrality code of conduct. So imagine Norwegian surprise this week when Telenor bosses went public with their hope to charge sites like YouTube and state broadcaster NRK.

In an interview with the business daily Dagens Næringsliv, a Telenor exec made the usual case: YouTube uses too much traffic and it needs to compensate ISPs for it. "The regime for distribution of data content is free for the sender, and this must be changed," said Telenor's CTO. "For the content providers it means that they will have to pay to make content available online, regardless of how much they send." Sites that pay up will get quality of service guarantees; everyone else goes into the "best effort" pool.